mediaplanung[.]biz

Analysis of www.mediaplanung.biz on 19 July 2026 indicates active credential‑phishing infrastructure. The site presents the page title "Cybernetic Web Dashboard — Login", suggesting an attempt to harvest login credentials. TLS termination is performed by an Evilginx API certificate referencing wace.space, a known phishing kit. The domain resolves to 157.173.195.214, an IP owned by Contabo GmbH in the United States. HTTP requests receive a 302 redirect, a typical technique to forward victims to a credential‑collection endpoint. Registration was performed through Spaceship, Inc., and the authoritative nameservers are keaton.ns.cloudflare.com and tina.ns.cloudflare.com, both Cloudflare‑managed. VirusTotal reports four of ninety‑one scanners flagging the domain, reinforcing the malicious assessment. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. Current evidence confirms the site is still reachable and serving the phishing page. Uncertainty remains regarding the full scope of compromised accounts or any secondary payloads, as no additional payload analysis is available. Defenders should block the domain at perimeter filters, add the IP address 157.173.195.214 to deny lists, monitor for authentication attempts to services that may be targeted, and continue to watch for related indicators such as the Evilginx certificate and the Cloudflare nameservers. Ongoing observation is recommended to detect any future changes in hosting or additional phishing campaigns.